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ATTACHMENT - CLAIMS LISTING 

This listing of claims will replace all prior versions, and listings, of claims in the 
application. 

1. (Canceled) 

2. (Currently Amended) A method according to claim-4 130 , in which the 
predetermined authentication information stored by each authentication storage 
m e ans device corresponds to information which is used to authenticate a user of that 
authentication storage meam device in relation to the telecommunications system. 

3. -4. (Cancelled) 

5. (Currently Amended) A method according to claims 130 , wherein each user is 
authenticated in the telecommunications system by a smart card or subscriber identity 
module, and in which the authentication storage m e ans device respective to that user 
corresponds to or simulates the smart card for that user. 

6. (Currently Amended) A method according to claim 5, wherein the smart card or 
subscriber identity module authenticates the transaction wh e n after the smart card or 
subscriber identity module is operable in a terminal usable in a mobile and/or cellular 
telecommunications system. 

7. (Previously Presented) A method according to claim 6, wherein the smart card or 
subscriber identity module is operable to authenticate the terminal in the mobile and/or 
cellular telecommunications system. 

8. -10. (Cancelled) 
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1 1 . (Currently Amended) A method according to claim-4 130 , in which the 
authentication storage m e ans device is incorporated on a data carrier for data or 
software for use by that data processing apparatus. 

12. (Currently Amended) A method according to claims 130 , in which the 
auth e ntication process involvos authenticating step includes the steps of sending of a 
message,, and th e g e n e rat i on of generating a response dependent on the message and 
the predetermined information. 

13. -16. (Cancelled) 

17. (Currently Amended) A method according to claims 130 , further including the step 
cooperatively coupling the authentication storage means device for communication over 
te-a carrie r with the transaction manager . 

18. (Cancelled) 

19. (Previously Presented) A method according to claim 17, wherein the carrier is 
operatively coupled to the data processing apparatus by a wireless link. 

20. (Previously Presented) A method according to claim 17, wherein the authentication 
storage m e ans device is removably coupled to the carrier. 

21. (Cancelled) 

22. (Previously Presented) A method according to claim 17, comprising the step of 
using said carrier to obtain user security data independently of the data processing 
apparatus, and analysing the user security data for determining whether to allow access 
to the predetermined information. 
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23. (Original) A method according to claim 22, wherein the security data is obtained by 
alphanumeric data entry means . 

24. (Cancelled) 

25. (Currently Amended) A method according to claim 22, wherein the user security 
data comprises a Personal Identification Number (PIN) and the analysing step 
compares the PIN obtained by the security data entry moans device with a PIN stored 
on the authentication storage m e ans device and only allows access to the 
predetermined information when the respective PINs match. 

26. (Cancelled) 

27. (Previously Presented) A method according to claim 17, wherein communication 
with the data processing apparatus is controlled by a data processing module. 

28. -29. (Cancelled) 

30. (Previously Presented) A method according to claim 27, wherein the data 
processing module of the carrier decrypts encrypted data received from the data 
processing module of the data processing apparatus. 

31 . (Previously Presented) A method according to claim 27, wherein the data 
processing module of the carrier encrypts data transmitted to the data processing 
module of the data processing apparatus. 

32. (Previously Presented) A method according to claim 30, wherein the respective 
data processing modules comprise a key for allowing encryption and/or decryption of 
data. 
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33. (Previously Presented) A method according to claim 32, wherein the key 
comprises a shared secret key for each of the respective data processing modules. 

34. (Currently Amended) A method according to claim 17, wherein the carrier is 
operatively coupled to a plurality of authentication storage m e ans device for respectively 
enabling the said authentication process and one or more other authentication 
processes. 

35. (Cancelled) 

36. (Currently Amended) A method according to claim-4 130 , including routing 
communications between the authentication storage m e ans device and the 
telecommunications system via the transaction manager. 

37. (Currently Amended) A method according to claim-4 130 , wherein the transaction 
manager is implemented by the data processing apparatus. 

38. (Currently Amended) A method according to claims 130 , wherein the transaction 
manager detects the operative coupling of the authentication storage means device . 

39. (Previously Presented) A method according to claim 36, wherein the transaction 
manager transmits data relating to an authenticated transaction to the entity to which 
that transaction relates. 

40. -51. (Cancelled) 

52. (Currently Amended) Data processing system for carrying out an authentication 
process for authenticating a transaction by any one of a plurality of users with an entity, 
said data processing system comprising: 
a data processing apparatus, 
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a selected one of a plurality of authentication storage devices moans in operative 
association with the data processing apparatus, each said authentication storage 
m e ans device fer-storing predetermined authentication information relating to the 
carrying out of the authentication process, the entity being operable to generate 
transaction data relating to the transaction, and 

a common telecommunications system which is registerable with the plurality of the 
authentication storage devices -means, 

a communications link with the telecommunications system by which the 
authentication storage devices m e ans wh e n is operativelv associated with the data 
processing apparatus is op e rat i v e to carry out the authentication process, and 

an authenticating device means incorporated in the telecommunications system by 
which the authentication process is carried out and which involves the use of the 
predetermined authentication information respective to the user stored by the selected 
one authentication storage devices means , the predetermined authentication 
information being stored by each authentication storage means- devices corresponding 
to information which is used to authenticate a telecommunications terminal of that user 
in relation to the telecommunications system but the authentication process for 
authenticating the transaction by that user with the data processing apparatus not 
requiring use of that user's telecommunications terminal, 

the data processing apparatus comprising at least a transaction manager through 
which communications between the data processing apparatus and the 
telecommunications system are transmitted and through which the predetermined 
authentication information is also transmitted between the authentication storage moans 
device and the telecommunications system, the transaction manager being 
implemented by the data processing apparatus. 

53. (Currently Amended) A data processing system according to claim 52, in which the 
predetermined authentication information stored by each authentication storage 
m o ans device corresponds to information which is used to authenticate a user of that 
authentications storage m e ans device in relation to the system. 
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54. - 55. (Cancelled) 

56. (Currently Amended) A data processing system according to claim 53, in which 
each user is authenticated in the telecommunications system by m e ans of t he use of a 
smart card or subscriber identity module, and in which the authentication storage 
m e ans device respective to that user corresponds to or simulates the smart card for that 
user. 

57. (Previously Presented) A data processing system according to claim 56, wherein 
the smartcard or subscriber identity module is operable in a terminal usable in a mobile 
and/or cellular telecommunication system to authenticate the transaction. 

58. (Previously Presented) A data processing system according to claim 57, wherein 
the smartcard or subscriber identity module is operable to authenticate the terminal in 
the mobile and/or cellular telecommunication system. 

59. -60. (Cancelled) 

61. (Previously Presented) A data processing system according to claim 52, in which 
the authentication process involves the sending of a message and the generation of a 
response dependent on the message and the predetermined information. 

62. -65. (Cancelled) 

66. (Currently Amended) A data processing system according to claim 52, wherein a 
carrier is provided for the authentication storage m e ans device and the authentication 
storage means device is operatively couplable to the carrier. 

■67. (Cancelled) 
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68. (Currently Amended) A data processing system according to claim 66, including 
meafts -a communication device for a l lowing wireless communication between the 
carrier and the data processing apparatus. 

69. (Currently Amended) A data processing system according to claim 66, including a 
coupling device m e ans for removably coupling the carrier to the authentication storage 
means device . 

70. (Cancelled) 

71 . (Previously Presented) A data processing system according to claim 66, wherein 
the carrier includes means for obtaining user security data independently of the data 
processing apparatus and means for analysing the user security data for determining 
whether to allow access to the predetermined information. 

72. (Currently Amended) A data processing system according to claim 71 , wherein the 
carrier comprises an alphanumeric data entry m e ans device fef-allowing the security 
data to be obtained. 

73. (Cancelled) 

74. (Currently Amended) A data processing system according to claim 71 , wherein the 
user security data comprises a personal identification number (PIN) and the analysing 
m e ans device is operable to compare the PIN obtained by the security data entry 
m e ans device with a PIN stored on the authentication storage m e ans device and for only 
allowing access to the predetermined information when the respective PINs match. 

75. (Cancelled) 
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76. (Previously Presented) A data processing system according to claim 66, wherein 
the carrier comprises a data processing module for controlling communication with the 
data processing apparatus. 

77. -78. (Cancelled) 

79. (Currently Amended) A data processing system according to claim 76, wherein the 
data processing module of the carrier includes means- a decrypting device f er-decrvptino 
encrypted data received from the data processing module of the data processing 
apparatus. 

80. (Previously Presented) A data processing system according to claim 76, wherein 
the data processing module of the carrier encrypts data transmitted to the data 
processing module of the data processing apparatus. 

81. (Previously Presented) A data processing system according to claim 79, wherein 
the respective data processing modules comprise a key for allowing encryption and/or 
decryption of data. 

82. (Previously Presented) A data processing system according to claim 81, wherein 
the key comprises a shared secret key for each of the respective data processing 
modules. 

83. (Currently Amended) A data processing system according to claim 66, wherein the 
carrier includes means- a coupling device fe F-operativelv coupling the carrier to a 
plurality of authentication storage m e ans device for respectively enabling said 
authentication process and one or more other authentication processes to be 
performed. 

84. (Cancelled) 
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85. (Currently Amended) A data processing system according to claim 52, wherein 
data communications between the authentication storage m e ans device and the 
telecommunications system are routed via the transaction manager. 

86. (Previously Presented) A data processing system according to claim 52, wherein 
the transaction manager is implemented by the data processing apparatus. 

87. (Currently Amended) A data processing system according to claim 52, wherein the 
transaction manager is operable to detect the operative coupling of the authentication 
storage m o ans device to the data processing moans device . 

88. (Previously Presented) A data processing system according to claim 52, wherein 
the transaction manager is operable to transmit data relating to an authenticated 
transaction to the entity to which that transaction relates. 

89. - 100. (Cancelled) 

101 . (Withdrawn) A device for coupling to data processing apparatus for enabling an 
authentication process involving the use of separate authenticating means, the device 
being configured to provide a plurality of separately activatable authentication 
information records for use in the authentication process, the authentication information 
records being registered with a system including the authenticating means, the device 
being responsive to an input message for deriving a response dependent on the input 
message and on the activated authentication information record for enabling the 
authenticating means to carry out the authentication process via a communication link 
with the authenticating means in the said system whereby to authenticate a transaction. 

102. (Withdrawn) The device of claim 101, including means for receiving a smart card 
or SIM which carries said plurality of authentication information record. 
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103. (Withdrawn) The device of claim 101, including means for receiving a plurality of 
smart cards or SIMs, each of which carries one of said plurality of authentication 
information records. 

104. (Withdrawn) The device of claim 101, including means for releasably coupling 
one or a plurality of smart cards or SIMs thereto, the authentication information records 
being stored on the smart card(s) or SIM(s). 

105. (Withdrawn) The device of claim 101, including means for receiving one or a 
plurality of smart cards or SIMs and for permanently coupling the smart card(s) or 
SIM(s) to the device. 

106. (Withdrawn) The device of claim 101 , including a data store for storing said 
plurality of separately activatable authentication information records. 

1 07. (Withdrawn) The device of claim 1 01 , wherein the plurality of authentication 
information records are selectively activated in response to a user input. 

108. (Withdrawn) The device of claim 107, wherein the user input is provided by 
activation of a switch. 

109. (Withdrawn) The device of claim 101, wherein the plurality of authentication 
information records are selectively activated in response to a signal received from the 
data processing device. 

110. (Withdrawn) An authentication system for authenticating transactions of users 
registered with that system to enable a transaction with another system to be 
authenticated, the authentication system including authentication means for sending an 
authentication message in response to an authentication request from a subscriber and 
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for receiving and analysing a response thereto to determine if the received response 
corresponds to an expected response to authenticate the identity of the user; and 
security token generating means for generating a security token for use in performing a 
transaction with the other system. 

111. (Withdrawn) The system of claim 110, wherein the security token includes data 
indicative of the identity of the user. 

112. (Withdrawn) The system of claim 110, wherein the security token includes data 
indicative of the nature of the transaction. 

113. (Withdrawn) The system of claim 110, including means for receiving a returned 
security token and for analysing the returned security token to determine its integrity 
and for providing a service in response to receipt of the returned security token. 

114. (Withdrawn) The system of claim 113, wherein the service is the processing of a 
payment associated with the transaction. 

115. (Withdrawn) The system of claim 110, including a register for storing data relating 
to a user for use in performing transactions. 

116. (Withdrawn) The system of claim 115, including means for transmitting the user 
data in response to a request from the user. 

1 1 7. (Withdrawn) The system of claim 1 1 5, including means for transmitting the user 
data in response to receipt of a returned security token. 

118. (Withdrawn) The system of claim 115, including means for transmitting the user 
data in response to receipt of a returned security token, and wherein the register stores 
for each user separate data records for each of a plurality of other services with which 
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the user performs transactions, and wherein only user data for a particular service is 
provided in response to a request for user data. 

119. (Withdrawn) The system of claim 118, wherein the returned security token is 
analysed to determine to which service it relates, and in response thereto user data for 
that service is provided to that service. 

120. (Withdrawn) A system for storing user data for use in performing transactions with 
a plurality of service providers, wherein for each user a plurality of data records are 
stored for use when performing transactions with respective service providers, and 
wherein only a data record relevant to a particular service provider is made available in 
response to a request on behalf of that service provider. 

121 . (Withdrawn) The system of claim 120, including means for authenticating a 
request for user data on behalf of a service provider. 

122. (Withdrawn) A data packet for use in authenticating and performing a transaction 
between a client and a product or service provider, the data packet including data 
indicative of the product or service provider identity such that the data packet is only 
useable to authenticate and perform a transaction with that product or service provider. 

123. (Withdrawn) The data packet of claim 122, wherein the data packet includes data 
indicative of the client identity such that the data packet is only useable to authenticate 
and perform a transaction with that client. 

124. (Withdrawn) An authentication system for authenticating transactions between a 
client and a product or service provider, including means for generating a data packet 
according to claim 122 and means for transmitting the data packet to the service 
provider. 
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125. (Withdrawn) A method of facilitating transactions between a plurality of users 
registered with an authentication system and plurality of product or service providers, 
the method including: 

providing each user with authentication storage means storing predetermined 
authentication information, each authentication storage means being couplable to data 
processing apparatus for data exchange therewith; 

generating in response to a request, made using data processing apparatus, 
from a user to a product or service provider a transaction request data packet including 
data indicative of the identity of the user and the identity of the product or service 
provider; 

transmitting the transaction request data packet to the authentication system via 
the data processing apparatus; 

analysing in the authentication system the transaction request data packet and 
extracting therefrom the identity of the user; 

transmitting from the authentication system an authentication request signal to 
the user's authentication storage means via the data processing apparatus; 

receiving via the data processing apparatus a response from the user's 
authentication storage means at the authentication system; 

analysing said response at the authentication system to determine whether said 
response corresponds to an expected response with reference to knowledge of said 
predetermined authentication information for that user; 

generating an authentication token and providing this to the product or service 
provider via the data processing apparatus, the authentication token indicating to the 
product and service provider that the user is authenticated by the authentication system. 

126. (Withdrawn) The method of claim 125, wherein the authentication token includes 
data indicative of the product or service provider that generated the transaction request 
data packet corresponding to the authentication token. 
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127. (Withdrawn) The method of claim 125, wherein the authentication token includes 
data indicative of the user. 

128. (Withdrawn) The method of claim 125, including receiving from the service 
provider at the authentication system a request for payment token, including the 
authentication token to which it relates, checking the validity of the authentication token 
prior to authorising a payment to the product or service provider from the user's account 
with the authentication system. 

129. (Withdrawn) A method for carrying out an authentication process for 
authenticating a subsequent transaction by any one of a plurality of users with an entity 
by means of data processing apparatus, in which: 

the entity generates transaction data relating to the transaction, and 
during the authentication process the data processing apparatus has operatively 
associated with it a selected one of a plurality of authentication storage means 
respective to the users, each authentication storage means storing predetermined 
authentication information and being registerable with a common telecommunications 
system for which the users have respective telecommunications terminals; 

the method including the step of carrying out the authentication process via a 
communications link with the common telecommunications system, the authentication 
process being carried out by authenticating means incorporated in the 
telecommunications system and involving the use of the predetermined authentication 
information stored by the selected one authentication storage means, the 
predetermined authentication information stored by each authentication storage means 
corresponding to information which is used to authenticate that user's 
telecommunications terminal in relation to the telecommunications system but the 
authentication process for authenticating the transaction by that user with the data 
processing apparatus not requiring use of that user's telecommunications terminal nor 
requiring the telecommunications terminal to be actually authenticated by that 
information in relation to the telecommunications system; 
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wherein in order to authenticate the transaction, the transaction data is 
transmitted between the data processing apparatus and the system via a transaction 
manager implemented by the data processing apparatus, and the predetermined 
authentication information is also transmitted between the authentication storage means 
and the system via the transaction manager. 

130. (New) A method for carrying out an authentication process for authenticating a 
transaction by one of a plurality of users with an entity, said method comprising the 
steps of: 

storing, on at least one authentication storage device of an authenticator of a 
telecommunications system, selected ones of a plurality of respective predetermined 
authentication information of each respective ones of the plurality of users, the 
respective predetermined authentication information corresponding to an actual 
authenticating information of a mechanism provided in a telecommunications terminal of 
each respective user which telecommunications terminal is associated with the 
telecommunications system; 

initiating by one user a desired transaction with the entity, said initiating step 
including the steps of 

establishing a communication between a transaction manager of the one user 
and a data processing apparatus of the entity and 

supplying of data by the user to the data processing apparatus of the entity; 
generating, by the data processing apparatus of the entity using the supplied data, 
transaction data relating to the desired transaction of the one user; 

authenticating the one user to the data processing apparatus of the entity before 
completing the transaction, said authenticating step including the steps of 

establishing a connection, via a common telecommunications system, between 
the data processing apparatus of the entity and the authentication storage device of the 
authenticator having the predetermined authentication information of the one user, 

implementing the transaction manager of the user by the data processing 
apparatus of the entity, said implementing step including the step of 
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transmitting the transaction data between the data processing apparatus of 
the entity and the telecommunications system, and 

transmitting the actual authenticating information of the telecommunications 
terminal of the user to the authenticator, said transmitting step not requiring use of the 
telecommunications terminal of the user; 

comparing the predetermined authentication information of the authentication 
storage device with the actual authenticating information by the authenticator to 
determine if there is a match, and communicating a match to the transaction manager; 
and 

completing the desired transaction of the one user by the data processing apparatus 
if a match is communicated to the transaction manager. 
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